We use cookies to improve your experience and analyse site usage. Cookie Policy
Last updated: February 26, 2026
Speako Pty Ltd (ABN 39 682 800 371) ("Speako", "we", "us", or "our") is committed to protecting your privacy and handling personal information in accordance with applicable privacy and data protection laws, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
Depending on where Subscribers and End Users are located and the nature of the interaction with the Service, additional laws and regulatory frameworks may apply (for example, GDPR/UK GDPR, CCPA/CPRA, or Canadian privacy laws).
This Privacy Policy explains how we collect, use, disclose, and safeguard personal information when you use the Speako.ai service ("Service"), visit our website, or interact with us in any way. It applies to:
By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Service.
When you register for the Service, we collect:
Payment processing is handled by Stripe. We do not store your full credit card or debit card details on our servers. Stripe may collect and process your payment card number, expiration date, and billing address. We receive and store a limited set of payment information from Stripe, including the last four digits of your card, card type, and billing history.
When End Users interact with AI voice agents through the Service, we collect:
See Section 5 for detailed information about voice recording practices.
When End Users call a business using Speako, we may collect:
We automatically collect certain information when you use the Service or visit our website:
We use cookies and similar technologies to collect information about your interactions with our website and Service. For full details, please see our Cookie Policy.
We process personal information in accordance with the Australian Privacy Principles. Our legal bases for processing include:
Where GDPR (or similar laws) applies, the legal bases described above are intended to align with applicable lawful bases (including under GDPR Article 6).
We use the information we collect for the following purposes:
AI model training: Speako does not use Customer Data (including voice recordings or transcripts) to train publicly available or general-purpose AI models. We use third-party AI providers via API-based services under contractual data protection obligations. Where available, we seek to contractually restrict Subprocessors from using Customer Data to train their publicly available or general-purpose models.
Given the nature of our Service, voice recording and call data require special attention. This section provides detailed information about our practices.
When an End User calls a business that uses Speako, the voice conversation between the End User and the AI voice agent may be recorded. This includes the audio of the conversation and an automatically generated text transcript.
Subscriber responsibilities: As a Subscriber, you are the data controller for Customer Data processed through your AI voice agent. You are responsible for:
Speako provides configurable greeting messages that can include AI and recording disclosures. When voice recording retention is enabled, Speako requires that the Subscriber's Initial Greeting, Return Customer Greeting, and After Hours Message each include a recording disclosure. Speako's system validates that the recording disclosure adequately informs callers that the call may be recorded.
Voice recordings and transcripts are stored using cloud storage and access controls designed to protect confidentiality. Access to recordings is restricted to the Subscriber whose AI agent handled the call and to authorised Speako personnel for support and operational purposes.
Subscribers can enable or disable voice recording retention through their dashboard settings. When enabled, voice recordings are retained for 90 days from the date of the call by default, up to a maximum of 180 days if configured by the Subscriber, after which they are automatically deleted. Subscribers may request earlier deletion at any time. When disabled, call audio is processed in real-time for the AI conversation but is not stored after the call ends. Transcripts and call metadata may be retained for the duration of the Subscriber's Account (see Section 9). We may retain aggregated and/or de-identified analytics for service improvement.
During a live call, voice audio is streamed in real-time to our AI provider (ElevenLabs) for processing and response generation. Audio is also processed by Twilio for telephony routing. Speako does not use voice recordings to train AI models. Please refer to our third-party providers' privacy policies for information about their data handling practices (see Section 6).
The Service is not designed to perform and Speako does not perform biometric identification, voiceprint identification, or voiceprint recognition to uniquely identify an individual. You must not use the Service to collect, capture, store, or process biometric identifiers or biometric information (including voiceprints) for identification or authentication purposes.
We share personal information with the following categories of third parties for the purposes described below. We do not sell your personal information.
| Provider | Purpose | Data Shared |
|---|---|---|
| Twilio | Telephony, phone numbers, SMS delivery | Call audio, phone numbers, SMS content |
| ElevenLabs | Conversational AI voice processing | Call audio streams, agent configuration |
| OpenAI | Natural language processing | Text data for NLP tasks |
| Stripe | Payment processing | Payment details, billing information |
| Clerk | Authentication and user management | Email, name, authentication data |
| SendGrid | Transactional email delivery | Email addresses, email content |
| Cloudflare R2 | File and media storage | Voice recordings, documents, files |
| Google Analytics | Website analytics | Usage data, IP address (anonymised) |
We may also share information: (a) with your consent; (b) to comply with legal obligations; (c) to protect our rights, privacy, safety, or property; (d) in connection with a merger, acquisition, or sale of assets (in which case your information will remain subject to this Privacy Policy).
We will provide reasonable advance notice of material changes to our sub-processors that materially affect the processing of personal information (typically at least 30 days before a change takes effect), via email or notice on the Service.
Speako is based in Australia, but your information may be transferred to and processed in countries other than Australia, including the United States, where our third-party service providers operate. These countries may have data protection laws that differ from the laws of your country.
In accordance with APP 8 (cross-border disclosure of personal information), we take reasonable steps to ensure that overseas recipients handle your personal information in accordance with the Australian Privacy Principles. This includes entering into contractual arrangements with our sub-processors that require them to protect personal information to standards comparable to those under Australian law.
For users in the EEA, we rely on appropriate transfer mechanisms such as Standard Contractual Clauses or other safeguards recognised under applicable law.
We implement appropriate technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure, or destruction. These measures may include:
No method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security.
We retain personal information for as long as necessary to fulfil the purposes described in this Privacy Policy, unless a longer retention period is required by law. Specific retention periods include:
When personal information is no longer required, we will securely delete or anonymise it. Anonymised data that cannot be used to identify individuals may be retained indefinitely for analytics and research purposes.
Depending on your location and applicable law, you may have the following rights regarding your personal information:
Under the Privacy Act 1988 and the Australian Privacy Principles, you have the right to:
If you are located in the European Economic Area or the United Kingdom, you additionally have the right to:
If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with additional rights:
To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days (or the applicable timeframe required by law). We may need to verify your identity before processing your request.
In the event of a data breach that is likely to result in serious harm to affected individuals, we will:
Breach notifications will include the nature of the breach, the types of information involved, and the steps we are taking in response.
The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you become aware that a child under 16 has provided us with personal information, please contact us at [email protected], and we will take steps to delete such information promptly.
The Service uses artificial intelligence to make automated decisions during voice calls, including:
These automated decisions are made in the context of the Subscriber's business operations and are subject to the Subscriber's configuration and oversight. Where GDPR applies, individuals in the EEA may have rights under GDPR Article 22 regarding certain decisions based solely on automated processing. If you believe an automated decision has significantly affected you, you may contact the Subscriber (the business you called) or us at [email protected].
Understanding who is responsible for personal information is important:
Subscribers requiring a formal Data Processing Addendum / Data Processing Agreement (DPA) may contact us at [email protected].
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the Service. When we make changes:
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Complaints: If you are not satisfied with our response to a privacy concern, you have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC):
For users in the EEA/UK, you may also lodge a complaint with your local data protection supervisory authority.
We're here to help. Contact our support team anytime.